3

I want to have following Setup:

OpenLDAP Server where Users are stored.

File Server with Samba Shares, where OpenLDAP Users should have access to.

OpenLDAP Users already have access too several services (eg. Owncloud, Mediawiki and so on)

We DO NOT have a Domain Controller (I think Domain Controller isn't the right Word?). All Servers are Standalone Servers, mostly with only one local user (James) besides the root user. The workers client machines are also local users and not part of a Domain.

Of course I have googled a lot and tried a lot ..

WHAT I HAVE DONE:

Imported samba.ldif and created Indexes on OpenLDAP-Server.

ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/samba.ldif

Installed smbldap-tools on OpenLDAP-Server and configured them.

smbldap-populate >> no errors, a lot of Groups etc are created

Created a User

smbldap-useradd -a -P foo.bar

And changed the smb.conf on the Filesserver to

[global]
        workgroup = BEER
        security = user
        passdb backend = ldapsam:ldap://<IP>
        ldap suffix = dc=foo,dc=bar
        ldap user suffix = ou=People
        ldap group suffix = ou=Group
        ldap machine suffix = ou=Hosts
        ldap idmap suffix = ou=Idmap
        ldap admin dn = cn=Manager,dc=foo,dc=bar
        #ldap ssl = start tls
        ldap ssl = no
        ldap passwd sync = yes
#       passdb backend = tdbsam
        printing = cups
        printcap name = cups
        load printers = yes
        cups options = raw

Also added the LDAP Admin Password with smbpasswd -w XXXXXXXXXX

in Apache DS I see the new User and TWO (?) SambaDomainName Entries -> BEER and FILESERVER .. They have two different SID's and the new User gets the SID-UID of the BEER DomainName ... the Domain BEER is created manually by me. (read this on a HowTo)

When I delete the Entry FILESSERVER and restart the Samba Server on the Fileserver it gets created again.

Also when I want to access the Samba Share, the user foo.bar isn't able to login.

I'm new to OpenLDAP and Samba .. so I really have no clue ...

SAMBA LOGS:

    [2017/02/28 10:42:19.698686,  0] ../lib/util/become_daemon.c:124(daemon_ready)
  STATUS=daemon 'smbd' finished starting up and ready to serve connections

LDAP LOG on OpenLDAP Server

Feb 28 10:46:01 OpenLDAP01 slapd[801]: conn=1058 fd=37 ACCEPT from IP=<IP>:60550 (IP=0.0.0.0:389)
Feb 28 10:46:01 OpenLDAP01 slapd[801]: conn=1058 op=0 BIND dn="cn=Manager,dc=foo,dc=bar" method=128
Feb 28 10:46:01 OpenLDAP01 slapd[801]: conn=1058 op=0 BIND dn="cn=Manager,dc=foo,dc=bar" mech=SIMPLE ssf=0
Feb 28 10:46:01 OpenLDAP01 slapd[801]: conn=1058 op=0 RESULT tag=97 err=0 text=
Feb 28 10:46:01 OpenLDAP01 slapd[801]: conn=1058 op=1 SRCH base="" scope=0 deref=0 filter="(objectClass=*)"
Feb 28 10:46:01 OpenLDAP01 slapd[801]: conn=1058 op=1 SRCH attr=supportedControl
Feb 28 10:46:01 OpenLDAP01 slapd[801]: conn=1058 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
Feb 28 10:46:01 OpenLDAP01 slapd[801]: conn=1058 op=2 SRCH base="dc=foo,dc=bar" scope=2 deref=0 filter="(&(uid=foo.bar)(objectClass=sambaSamAccount))"
Feb 28 10:46:01 OpenLDAP01 slapd[801]: conn=1058 op=2 SRCH attr=uid uidNumber gidNumber homeDirectory sambaPwdLastSet sambaPwdCanChange sambaPwdMustChange sambaLogonTime sambaLogoffTime sambaKickoffTime cn sn displayName sambaHomeDrive sambaHomePath sambaLogonScript sambaProfilePath description sambaUserWorkstations sambaSID sambaPrimaryGroupSID sambaLMPassword sambaNTPassword sambaDomainName objectClass sambaAcctFlags sambaMungedDial sambaBadPasswordCount sambaBadPasswordTime sambaPasswordHistory modifyTimestamp sambaLogonHours modifyTimestamp uidNumber gidNumber homeDirectory loginShell gecos
  • This case is working in my environment with samba 3.6 (ubuntu precise). Now I should migrate this case with samba 4.x. But unfortunately samba segfaults when user auth is done. At this moment I'm stumped. – vskubriev Feb 21 '18 at 14:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.